Pimcore Search Document cross site scripting

Root

Cause

The vulnerability resides in the Search Document component of Pimcore 11.4.2. When a user uploads a PDF file via the "Add Asset(s)" functionality, the application fails to properly sanitize the content. As a result, embedded JavaScript within the PDF can be executed when the document is viewed through the search interface. This is a classic stored cross-site scripting (XSS) flaw [1][3].

Exploitation

An attacker with an authenticated session (e.g., Administrator role) can upload a malicious PDF containing embedded scripts. The crafted document is then accessible via the Search Document functionality. Notably, the advisory states that the XSS payload can be served without authentication if the direct PDF URL is known, widening the attack surface to unauthenticated users who can access the uploaded asset path [3].

Impact

Successful exploitation allows arbitrary script execution in the context of the victim's browser. This can lead to session hijacking, defacement of web pages, or theft of sensitive information. Because scripts run under the Pimcore admin session, an attacker could perform administrative actions on behalf of the target, compromising the entire data management platform [1][3].

Mitigation

As of publication, the vulnerability is publicly disclosed with a proof of concept. No patch has been referenced in the available sources; users should monitor the Pimcore repository and security advisories for updates. In the interim, restricting PDF uploads to trusted roles and filtering file content may reduce risk [2][3].